Linux Kernel 6.12.103

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.12.103
• drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
• drm/fb-helper: Fix a locking bug in an error path
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• rxrpc: Fix irq-disabled in local_bh_enable()
• rxrpc: Manage RTT per-call rather than per-peer
• rxrpc: Fix the calculation and use of RTO
• rxrpc: Adjust the rxrpc_rtt_rx tracepoint
• rxrpc: Generate rtt_min
• drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
• drm/xe: Stub out new pagefault layer
• drm/i915/hdcp: check streams[] bounds before overflow
• drm/i915/hdcp: Skip inactive MST connectors when building stream list
• drm/i915/hdcp: require monotonically increasing seq_num_v
• drm/i915/hdcp: Move to using intel_display in intel_hdcp
• drm/xe: Hold a dma-buf reference for imported BOs
• drm/xe: Rename ___xe_bo_create_locked()
• drm/i915/vrr: require valid min/max vfreq for VRR
• drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
• drm/xe: Wait on external BO kernel fences in exec IOCTL
• drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
• drm/tegra: fbdev: Remove offset into framebuffer memory
• drm/fb-helper: Allocate and release fb_info in single place
• drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
• drm/amdgpu: give each kernel job a unique id
• drm/sched: Store the drm client_id in drm_sched_fence
• drm/amdgpu: Fix context pstate override handling
• drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
• mm/kmemleak: fix checksum computation for per-cpu objects
• kmemleak: iommu/iova: fix transient kmemleak false positive
• mptcp: pm: userspace: fix use-after-free in get_local_id
• mptcp: pm: use addr entry for get_local_id
• mptcp: add mptcp_userspace_pm_lookup_addr helper
• mptcp: pm: avoid code duplication to lookup endp
• ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
• wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
• wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
• wifi: ath6kl: fix use-after-free in aggr_reset_state()
• wifi: brcmfmac: drain bus_reset work on device removal
• media: uapi: rkisp: Correct name version enum
• media: chips-media: wave5: Support CBP profile
• media: imx219: Fix maximum frame length in lines
• media: i2c: imx219: Rename VTS to FRM_LENGTH
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• usb: gadget: f_tcm: synchronize delayed set_alt with teardown
• gpio: pch: use raw_spinlock_t for the register lock
• mm/slab: prevent unbounded recursion in free path with new kmalloc type
• lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
• mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
• drm/xe/rtp: Ensure locking/ref counting for OA whitelists
• drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
• drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
• drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
• drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
• drm/xe/rtp: Generalize whitelist_apply_to_hwe
• drm/xe/rtp: Keep track of non-OA nonpriv slots
• drm/xe/rtp: Maintain OA whitelists separately
• drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
• drm/xe: Apply whitelist to engine save-restore
• drm/xe: Introduce xe_gt_dbg_printer()
• drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
• Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
• of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
• ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
• ata: libahci_platform: Do not set mask_port_map when not needed
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amd/display: use proper context for logging
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/panthor: validate firmware interface structure sizes
• drm/panthor: reject firmware sections with oversized data
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation